Phishing and social engineering in Cybersecurity - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is phishing?

Phishing is a trick where attackers send fake messages or emails to steal personal information like passwords or credit card numbers.

beginner

Define social engineering in cybersecurity.

Social engineering is when attackers use human interaction tricks to get people to reveal confidential information or perform actions that help the attacker.

beginner

Give an example of a phishing attack.

An attacker sends an email pretending to be a bank asking you to click a link and enter your login details. The link leads to a fake website that steals your info.

intermediate

Why do social engineering attacks often succeed?

Because they exploit human trust, fear, or curiosity, making people act without thinking carefully.

beginner

Name two ways to protect yourself from phishing and social engineering.

1. Verify the sender's identity before clicking links or sharing info. 2. Use strong, unique passwords and enable two-factor authentication.

What is the main goal of a phishing attack?

A To steal personal information

B To improve computer speed

C To update software

D To backup data

Phishing attacks aim to steal personal information like passwords or credit card details.

Which of these is an example of social engineering?

A Sending a fake email to get your password

B Installing antivirus software

C Using a strong password

D Encrypting files

Social engineering involves tricking people, such as sending fake emails to steal passwords.

What should you do if you receive an unexpected email asking for your password?

A Reply with your password

B Click the link immediately

C Ignore all emails

D Verify the sender before responding

Always verify the sender's identity before sharing sensitive information.

Which feeling do social engineers often exploit to trick people?

A Boredom

B Trust

C Hunger

D Sleepiness

Social engineers exploit trust to make people reveal information or take actions.

What is a good way to protect against phishing?

A Click all links in emails

B Share passwords with friends

C Use two-factor authentication

D Ignore software updates

Two-factor authentication adds extra security beyond just a password.

Explain what phishing is and how it can affect you.

Think about how attackers trick people using emails or messages.

Describe social engineering and why it is effective.

Consider how attackers use psychology to trick people.

Practice

1. What is the main goal of a phishing attack?

easy

A. To trick people into giving personal information

B. To physically steal a computer

C. To improve internet speed

D. To update software automatically

Solution

1. Step 1: Understand phishing purpose

   Phishing attacks use fake messages to deceive people.

2. Step 2: Identify the attack goal

   The goal is to steal personal or sensitive information by tricking users.

3. Final Answer:

   To trick people into giving personal information -> Option A

4. Quick Check:

   Phishing = stealing info by tricking [OK]

Hint: Phishing steals info by fake messages [OK]

Common Mistakes:

• Confusing phishing with physical theft
• Thinking phishing improves technology
• Believing phishing updates software

2. Which of the following is a common sign of a phishing email?

easy

A. An email asking for your password urgently

B. An email from a known contact with no links

C. A newsletter you subscribed to

D. A system update notification from your computer

Solution

1. Step 1: Identify phishing email traits

   Phishing emails often create urgency and ask for sensitive info like passwords.

2. Step 2: Match the option to phishing signs

   An email asking for your password urgently shows urgency and password request, a common phishing tactic.

3. Final Answer:

   An email asking for your password urgently -> Option A

4. Quick Check:

   Urgent password request = phishing sign [OK]

Hint: Urgent password requests often mean phishing [OK]

Common Mistakes:

• Thinking all emails from contacts are safe
• Confusing newsletters with phishing
• Assuming system updates ask for passwords

3. Consider this message: "Your account will be locked in 24 hours. Click here to verify." What is the most likely purpose of this message?

medium

A. To warn about a real account issue

B. To update account settings securely

C. To steal login details through a fake link

D. To provide customer support contact

Solution

1. Step 1: Analyze message content

   The message creates urgency and includes a suspicious link.

2. Step 2: Identify phishing behavior

   Fake links are used to steal login details by tricking users.

3. Final Answer:

   To steal login details through a fake link -> Option C

4. Quick Check:

   Urgency + fake link = phishing attempt [OK]

Hint: Urgent messages with links often steal info [OK]

Common Mistakes:

• Believing all urgent messages are real
• Clicking links without checking URL
• Assuming links always lead to safe sites

4. You receive an email that looks like it's from your bank but the sender's address is [e-mail]. What is the best action to take?

medium

A. Reply asking for more details

B. Verify the sender's address and contact the bank directly

C. Click the link to check your account immediately

D. Forward the email to friends to warn them

Solution

1. Step 1: Check sender's email carefully

   The sender's address looks suspicious and not official.

2. Step 2: Choose safe verification method

   Contacting the bank directly using official channels avoids phishing risks.

3. Final Answer:

   Verify the sender's address and contact the bank directly -> Option B

4. Quick Check:

   Verify sender + direct contact = safe action [OK]

Hint: Always verify sender and contact official source [OK]

Common Mistakes:

• Clicking suspicious links immediately
• Replying to unknown senders
• Sharing suspicious emails without checking

5. A social engineer tries to gain access to a company by pretending to be a trusted delivery person. Which of the following is the best way to prevent this type of attack?

hard

A. Share passwords with delivery staff for convenience

B. Allow anyone with a delivery badge inside

C. Ignore all visitors to avoid risk

D. Verify identity and delivery details before granting access

Solution

1. Step 1: Understand social engineering tactics

   Attackers use trust and fake identities to gain access.

2. Step 2: Identify proper security response

   Verifying identity and delivery details prevents unauthorized entry.

3. Final Answer:

   Verify identity and delivery details before granting access -> Option D

4. Quick Check:

   Verify identity = prevent social engineering [OK]

Hint: Always verify before trusting visitors inside [OK]

Common Mistakes:

• Trusting anyone with a badge
• Ignoring visitors completely
• Sharing sensitive info with outsiders